If any of Arqit’s third parties’ systems, its customers’ cloud or on-premises environments, or its internal systems are breached or if unauthorized access to customer or third-party data is otherwise obtained, public perception of its business may be harmed, and Arqit may lose business and incur losses or liabilities.
Arqit’s success depends in part on its ability to provide effective data security protection in connection with its platforms and services, and Arqit relies on information technology networks and systems to securely store, transmit, index, and otherwise process electronic information. Because its platforms and services are used by its customers to encrypt large data sets that often contain proprietary, confidential, and/or sensitive information (including in some instances personal or identifying information and personal health information), its software is perceived as an attractive target for attacks by computer hackers or others seeking unauthorized access, and its software faces threats of unintended exposure, exfiltration, alteration, deletion, or loss of data. Additionally, because many of Arqit’s customers use its platforms to store, transmit, and otherwise process proprietary, confidential, or sensitive information, and complete mission critical tasks, they have a lower risk tolerance for security vulnerabilities in its platforms and services than for vulnerabilities in other, less critical, software products and services.
Arqit, and the third-party vendors upon which Arqit relies, have experienced, and may in the future experience, cybersecurity threats, including threats or attempts to disrupt its information technology infrastructure and unauthorized attempts to gain access to sensitive or confidential information. Its and its third-party vendors’ technology systems may be damaged or compromised by malicious events, such as cyberattacks (including computer viruses, malicious and destructive code, phishing attacks, and denial of service attacks), physical or electronic security breaches, natural disasters, fire, power loss, telecommunications failures, personnel misconduct, and human error. Such attacks or security breaches may be perpetrated by internal bad actors, such as employees or contractors, or by third parties (including traditional computer hackers, persons involved with organized crime, or foreign state or foreign state-supported actors).
Cybersecurity threats can employ a wide variety of methods and techniques, which may include the use of social engineering techniques, are constantly evolving, and have become increasingly complex and sophisticated; all of which increase the difficulty of detecting and successfully defending against them.
Furthermore, because the techniques used to obtain unauthorized access or sabotage systems change frequently and generally are not identified until after they are launched against a target, Arqit and its third-party vendors may be unable to anticipate these techniques or implement adequate preventative measures. Although prior cyberattacks directed at Arqit have not had a material impact on its financial results, and Arqit is continuing to bolster its threat detection and mitigation processes and procedures, Arqit cannot guarantee that future cyberattacks, if successful, will not have a material impact on its business or financial results. While Arqit has security measures in place to protect its information and its customers’ information and to prevent data loss and other security breaches, there can be no assurance that Arqit will be able to anticipate or prevent security breaches or unauthorized access of its information technology systems or the information technology systems of the third-party vendors upon which Arqit relies. Despite its implementation of network security measures and internal information security policies, data stored on personnel computer systems is also vulnerable to similar security breaches, unauthorized tampering or human error.
Many governments have enacted laws requiring companies to provide notice of data security incidents involving certain types of data, including personal data. In addition, most of Arqit’s customers contractually require Arqit to notify them of data security breaches. If an actual or perceived breach of security measures, unauthorized access to its system or the systems of the third-party vendors that Arqit rely upon, or any other cybersecurity threat occurs, Arqit may face direct or indirect liability, costs, or damages, contract termination, its reputation in the industry and with current and potential customers may be compromised, its ability to attract new customers could be negatively affected, and its business, financial condition, and results of operations could be materially and adversely affected.
Further, unauthorized access to Arqit’s or its third-party vendors’ information technology systems or data or other security breaches could result in the loss of information; significant remediation costs; litigation, disputes, regulatory action, or investigations that could result in damages, material fines, and penalties; indemnity obligations; interruptions in the operation of its business, including its ability to provide new product features, new platforms, or services to its customers; damage to its operation technology networks and information technology systems; and other liabilities. Moreover, its remediation efforts may not be successful. Any or all of these issues, or the perception that any of them have occurred, could negatively affect Arqit’s ability to attract new customers, cause existing customers to terminate or not renew their agreements, hinder Arqit’s ability to obtain and maintain required or desirable cybersecurity certifications, and result in reputational damage, any of which could materially adversely affect its results of operations, financial condition, and future prospects. There can be no assurance that any limitations of liability provisions in Arqit’s license arrangements with customers or in its agreements with vendors, partners, or others would be enforceable, applicable, or adequate or would otherwise protect it from any such liabilities or damages with respect to any particular claim.
Arqit maintains cybersecurity insurance and other types of insurance, subject to applicable deductibles and policy limits, but its insurance may not be sufficient to cover all costs associated with a potential data security incident. Arqit also cannot be sure that its existing